KQL Search

Query Details

Anomalies UEBA Anomalous Account Creation

Query

Anomalies
| where RuleName endswith "UEBA Anomalous Account Creation" and RuleStatus != "Flighting"
| extend
    Query = ExtendedLinks[0]["DetailBladeInputs"],
    UserCreated = extract(@'\"UserCreated\"\:\"([^\"]+)\"', 1, tostring(ActivityInsights))
| project
    TimeGenerated,
    RuleName,
    Description,
    Query,
    UserPrincipalName,
    UserCreated,
    ActivityInsights,
    DeviceInsights,
    UserInsights,
    Score,
    AnomalyDetails,
    Entities,
    Tactics,
    Techniques,
    ExtendedLinks

Explanation

This query is filtering anomalies based on a specific rule name and rule status. It then extends the query to extract information about the user who created the anomaly. The final result includes various fields such as time generated, rule name, description, query, user principal name, user created, activity insights, device insights, user insights, score, anomaly details, entities, tactics, techniques, and extended links.

Details

Jose Sebastián Canós

Released: December 15, 2022

Tables

Anomalies

Keywords

AnomaliesRuleNameRuleStatusQueryUserCreatedTimeGeneratedDescriptionUserPrincipalNameActivityInsightsDeviceInsightsUserInsightsScoreAnomalyDetailsEntitiesTacticsTechniquesExtendedLinks

Operators

whereendswith!=extendextracttostringproject

Actions

GitHub